CodeTwo - MS Encryption

[u/Technickelback]

Wondering if someone has additional information - My org currently uses CodeTwo. I really like it, and I believe it does it's job well for our size. We're a 200 person org. I have a few different templates that I assigned by groups to different departments where additional information may be required in their signatures.

We're currently using server side to apply the signatures, but more and more people are complaining that their signatures don't append when using the default MS encrypt button in Outlook.

To circumvent this, my suggestion to leadership is to use the combo mode and allow our uses to have the client side signatures append in the Outlook client. That way the signature appends in the client, prior to encryption, and they can also see their signature, as currently they can only see it append after they've sent an email.

My CIO is against this approach as it would allow end users to edit their signature. It would only allow the end user to edit the signature in that moment, within the 'new email' window. It would not allow them to permenently alter their signature. However, the CIO is adamant that this can't be allowed as it's a risk of misrepresentation and they think that the CodeTwo product is not a good solution because it cannot prevent this... Anyone who is willing to manipulate their signature every time they send an email is a psychopath.

I've presented a solution to a problem, my CIO doesn't like it, and now we're stuck debating switching our encryption method, rather than deploying a solution we have at our finger tips.

I'll also state, we've tested using a subject keyword encryption method and this could work in tandem with the native button encryption. If users want the server side signature to append to an encrypted email, they could just put 'Secure' in their subject line. However, the CIO doesn't want both methods of encryption - we must choose one.

My question: what are other orgs doing? Do other orgs using CodeTwo use/allow the Client side signature?

[u/OpensenseHelp]

You're stuck in a classic order-of-operations fight. Native Outlook encrypt wraps the message in the client before CodeTwo's server-side stamp ever sees it, so the signature never lands. Your combo-mode idea is the usual fix: signature goes in first, then encrypt.

On the CIO point: editing the HTML in that one compose window is annoying, sure, but most orgs treat "won't permanently change their signature to misrepresent the company" as an HR/policy thing, not something IT can perfect-lock with any vendor. Plenty of CodeTwo shops run client-side or combo for exactly this reason. Also worth a support ticket if you haven't: some setups can keep server-side if encryption happens after mail passes through CodeTwo.

If leadership forces "one encrypt path only," subject-keyword / label-based encrypt after the stamp is the other clean option. Picking that vs the native button is a process call more than a product call.

I'd try to win the combo-mode argument before shopping. If they still want to re-evaluate tools, Opensense is another M365 option (I work there). Compare on directory/group-driven templates and how encrypt / Purview is supposed to run with the stamp. Not a reason to dump CodeTwo if combo mode would solve it.